WO2016173284A1 - Procédé de communication de terminal mobile, et terminal mobile - Google Patents

Procédé de communication de terminal mobile, et terminal mobile Download PDF

Info

Publication number
WO2016173284A1
WO2016173284A1 PCT/CN2015/098761 CN2015098761W WO2016173284A1 WO 2016173284 A1 WO2016173284 A1 WO 2016173284A1 CN 2015098761 W CN2015098761 W CN 2015098761W WO 2016173284 A1 WO2016173284 A1 WO 2016173284A1
Authority
WO
WIPO (PCT)
Prior art keywords
mobile terminal
virtual core
secure virtual
secure
wireless communication
Prior art date
Application number
PCT/CN2015/098761
Other languages
English (en)
Chinese (zh)
Inventor
利文浩
夏虞斌
陈海波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020177034118A priority Critical patent/KR101940164B1/ko
Priority to EP15890658.6A priority patent/EP3282735A4/fr
Publication of WO2016173284A1 publication Critical patent/WO2016173284A1/fr
Priority to US15/795,491 priority patent/US10638311B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/68—Circuit arrangements for preventing eavesdropping

Definitions

  • the present invention relates to the field of communications, and in particular, to a secure communication method for a mobile communication terminal and a mobile communication terminal.
  • mobile terminals have been widely popularized, and mobile terminals have become an indispensable item in daily life of users.
  • private information is transmitted, and such private information may be eavesdropped by criminals, thereby causing serious consequences such as user privacy leakage and property damage.
  • the security of mobile communication has become a topic of increasing concern to the government, society and users.
  • the issue of network security and information security has even risen to the national strategic level.
  • the process of having a recording module is searched and closed before the mobile terminal initiates or answers the call, so that the content of the call is prevented from being sneaked, and the background process can be prevented from eavesdropping.
  • the above method is based on the premise that the operating system of the mobile terminal is trusted to prevent eavesdropping of the background process.
  • the architecture of their operating systems is becoming more and more complex, and there are more and more security vulnerabilities.
  • a communication security technology that can prevent attacks from operating systems needs to be developed. .
  • the embodiment of the invention discloses a secure communication method for a mobile terminal and a mobile terminal, which can prevent the operating system from eavesdropping on the communication content of the user and improve the security of the communication of the mobile terminal.
  • a first aspect of the embodiments of the present invention discloses a secure communication method for a mobile terminal, where the application processor of the mobile terminal includes a secure virtual core and a common virtual core, and the secure virtual core and the common virtual core share the mobile a central processing unit CPU, a memory, a bus, and a peripheral device of the terminal, and the program of the normal virtual core is prohibited from accessing application processor resources of the secure virtual core;
  • the secure communication method includes:
  • a wireless communication connection will be established between the mobile terminal and another mobile terminal, and the wireless communication
  • the mobile terminal sets a shared memory between the secure virtual core and the common virtual core and a peripheral device required to be called by the wireless communication connection to prohibit the Program access to a normal virtual kernel;
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core;
  • the mobile terminal outputs the processed communication content that passes the preset policy by using the secure virtual core.
  • the peripheral device that is required to be invoked by the wireless communication connection includes a recording device, where the communication content includes a recorded audio signal;
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core, and specifically includes:
  • the mobile terminal When the communication content is an audio signal recorded by the recording device, the mobile terminal performs encryption processing on the recorded audio signal through the secure virtual core;
  • the mobile terminal encodes the audio signal subjected to the encryption process by using the secure virtual core to obtain an audio signal to be transmitted;
  • the mobile terminal uses the secure virtual core to output the processed communication content that is processed by the preset policy, and specifically includes:
  • Controlling by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal.
  • the peripheral device that is required to be invoked by the wireless communication connection includes an audio playback device, and the communication content includes the received content. audio signal;
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core, and specifically includes:
  • the mobile terminal decodes the audio signal through the secure virtual core
  • the mobile terminal decrypts the decoded audio signal by using the secure virtual core to obtain an audio signal to be played;
  • the mobile terminal outputs the processed through the preset policy by using the secure virtual core
  • the contents of the letter include:
  • the mobile terminal controls the audio playback device to play the to-be-played audio signal through the secure virtual core.
  • the peripheral device required to be invoked by the wireless communication connection includes a video recording device, and the communication content includes Recorded video signal;
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core, and specifically includes:
  • the mobile terminal When the communication content is a video signal recorded by the video recording device, the mobile terminal performs encryption processing on the recorded video signal by using the secure virtual core;
  • the mobile terminal encodes the video signal subjected to the encryption process by using the secure virtual core to obtain a video signal to be transmitted;
  • the mobile terminal uses the secure virtual core to output the processed communication content that is processed by the preset policy, and specifically includes:
  • the peripheral device that is required to be invoked by the wireless communication connection includes a display screen, and the communication content includes Received video signal;
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core, and specifically includes:
  • the mobile terminal decodes the received video signal by using the secure virtual core
  • the mobile terminal decrypts the decoded video signal by using the secure virtual core to obtain a video signal to be played;
  • the mobile terminal uses the secure virtual core to output the processed communication content that is processed by the preset policy, and specifically includes:
  • the mobile terminal controls the display screen to play the to-be-played video signal through the secure virtual core.
  • the secure communication method before the wireless communication connection is established between the mobile terminal and the another mobile terminal, the secure communication method further includes:
  • the mobile terminal sets the interrupt information related to the wireless communication connection that satisfies the preset security processing trigger condition to prohibit program access of the normal virtual core.
  • a second aspect of the embodiments of the present invention provides a mobile terminal, where the application processor of the mobile terminal includes a secure virtual core and a common virtual core, and the secure virtual core and the common virtual core share central processing of the mobile terminal.
  • CPU, memory, bus and peripherals, and the program of the normal virtual core is prohibited from accessing the application processor resources of the secure virtual core;
  • the mobile terminal includes:
  • a first setting unit configured to: when the wireless communication connection is established between the mobile terminal and another mobile terminal, and the wireless communication connection meets a preset security processing trigger condition, the secure virtual core and the The shared memory between the normal virtual cores and the peripheral device required to be called by the wireless communication connection are set to prohibit program access by the normal virtual core;
  • a processing unit configured to process, by using the secure virtual core, a preset policy for the communication content corresponding to the wireless communication connection;
  • an output unit configured to output, by using the secure virtual core, the processed communication content that passes the preset policy.
  • the peripheral device that is required to be invoked by the wireless communication connection includes a recording device, where the communication content includes a recorded audio signal;
  • the processing unit includes:
  • a first encryption subunit configured to perform encryption processing on the recorded audio signal by the secure virtual core when the communication content is an audio signal recorded by the recording device;
  • a first encoding subunit configured to encode the audio signal subjected to the encryption process by using the secure virtual core to obtain an audio signal to be sent;
  • the output unit is specifically configured to control, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal.
  • the peripheral device that is required to be invoked by the wireless communication connection includes an audio playback device, and the communication content includes Received audio signal;
  • the processing unit includes:
  • a first decoding subunit configured to decode the audio signal by the secure virtual core when the communication content is an audio signal received by the mobile terminal
  • a first decryption subunit configured to perform decryption processing on the demodulated and decoded audio signal by using the secure virtual core to obtain an audio signal to be played
  • the output unit is specifically configured to control, by the secure virtual core, the audio playback device to play the to-be-played audio signal.
  • the peripheral device that is required to be invoked by the wireless communication connection includes a video recording device, and the communication content includes a recorded video signal;
  • the processing unit includes:
  • a second encryption subunit configured to perform encryption processing on the recorded video signal by using the secure virtual core when the communication content is a video signal recorded by the video recording device;
  • a second encoding subunit configured to encode the video signal subjected to the encryption process by using the secure virtual core to obtain a video signal to be sent;
  • the output unit is specifically configured to control, by the secure virtual core, the mobile terminal to send the to-be-sent video signal to the another mobile terminal.
  • the peripheral device that is required to be invoked by the wireless communication connection includes a display screen, and the communication content includes a received video signal;
  • the processing unit includes:
  • a second decoding subunit configured to: when the communication content is a video signal received by the mobile terminal, decode the received video signal by using the secure virtual core;
  • a second decryption subunit configured to perform decryption processing on the decoded video signal by using the secure virtual core to obtain a video signal to be played;
  • the output unit is specifically configured to control the display screen to play the to-be-played video signal by using the secure virtual core.
  • the mobile terminal further includes:
  • a second setting unit configured to set interrupt information related to the wireless communication connection to prohibit program access of the common virtual core.
  • the mobile terminal when a wireless communication connection is established between the mobile terminal and another mobile terminal, and the wireless communication connection meets a preset security processing trigger condition, the mobile terminal will use a secure virtual core and a common virtual core.
  • the shared memory between the shared memory and the above-mentioned wireless communication connection is set to prohibit program access of the normal virtual core, and the communication content corresponding to the wireless communication connection is processed by the secure virtual core to perform a preset policy, and then the secure virtual is utilized.
  • the kernel outputs the communication content processed by the preset policy, which prevents the operating system and program running by the common virtual core from acquiring the communication content before processing, and also prevents the operating system from eavesdropping the communication content through the shared memory or related peripherals, thereby improving the communication of the mobile terminal. Security.
  • FIG. 1 is a schematic flow chart of an embodiment of a method for secure communication of a mobile terminal provided by the present invention
  • FIG. 2 is a schematic flow chart of another embodiment of a method for secure communication of a mobile terminal provided by the present invention.
  • FIG. 3 is a schematic flow chart of still another embodiment of a secure communication method of a mobile terminal provided by the present invention.
  • FIG. 4 is a schematic structural diagram of an embodiment of a mobile terminal provided by the present invention.
  • FIG. 5 is a schematic structural diagram of another embodiment of a mobile terminal provided by the present invention.
  • FIG. 6 is a schematic structural diagram of still another embodiment of a mobile terminal provided by the present invention.
  • FIG. 7 is a schematic structural diagram of still another embodiment of a mobile terminal provided by the present invention.
  • the mobile terminal includes but is not limited to a terminal that can be used for communication, such as a mobile phone, a personal computer, a notebook computer, or the like.
  • FIG. 1 is a schematic flowchart diagram of an embodiment of a method for secure communication of a mobile terminal according to the present invention.
  • the secure communication method includes the following steps:
  • the CPU (Central Processing Unit) of the mobile terminal includes at least an application processor.
  • the CPU of the mobile terminal further includes a baseband processor.
  • the application processor includes a secure virtual core and a common virtual core.
  • the secure virtual core and the common virtual core share the CPU, memory, peripheral devices, and bus of the mobile terminal.
  • the secure virtual memory monopolizes a part of the hardware resources of the application processor.
  • the program of the normal virtual kernel is prohibited from accessing the exclusive application processor resources of the secure virtual core.
  • the baseband processor runs the baseband system of the mobile terminal; the secure virtual core runs some security modules; the common virtual kernel runs the operating system of the mobile terminal, such as Android, iOS, Windows phone, and the like.
  • the mobile terminal may be a trustzone technology-based mobile terminal using an ARM (Advanced RISC Machine) processor.
  • ARM Advanced RISC Machine
  • the wireless communication connection may include, but is not limited to, a normal telephone connection, a network voice connection (including a voice connection between a network telephone or other real-time communication client), a network video connection, and the like.
  • the embodiment of the present invention may further connect the secure virtual core and the common virtual core when the mobile terminal and the another mobile terminal perform short message communication or mail communication.
  • the peripheral device called for shared memory and SMS communication or mail communication is set to prohibit program access by the normal virtual kernel.
  • the peripheral device required to be called by SMS communication or mail communication may include one or more of a button, a keyboard, a tablet, and a display.
  • the application processor will receive an interrupt request for the incoming call information sent by the baseband processor.
  • the wireless communication connection meets a preset security processing trigger condition
  • the another mobile terminal that establishes a wireless communication connection with the mobile terminal may meet the security condition set by the mobile terminal, for example,
  • the wireless communication connection is a wireless communication connection between the mobile terminal and a friend in the address book.
  • the type of the wireless communication connection conforms to a security type set by the mobile terminal, for example, the wireless communication connection is a telephone connection.
  • the wireless communication connection related interrupt information that meets the preset security processing trigger condition may be set to prohibit program access of the common virtual core. For example, when any incoming call signal is detected or an incoming call signal of a friend in the address book is detected, the baseband system sends an interrupt request for the incoming call information to the application processor, and the interrupt request of the incoming call information is preset to prohibit the normal virtual core. Access, so after the application processor receives the interrupt request for the incoming call information, the interrupt request of the incoming call information will be processed through the secure virtual core.
  • the peripheral device to be called at least includes a recording device and an audio playback device.
  • the recording device and the audio device may be the same device, such as a microphone of the mobile terminal.
  • the peripheral device to be called at least includes a video recording device, a recording device, an audio playback device, and a display screen, such as a camera, a microphone, and a display screen of the mobile terminal.
  • the mobile terminal may be a GIC (Generic Interrupt Controller) or a TZIC (TrustZone Interrupt Controller, TrustZone)
  • the interrupt controller sets the interrupt information associated with the wireless communication connection to a secure interrupt such that it is only accessed in the secure virtual core.
  • the GIC or the TZIC is connected to all the interrupt sources of the mobile terminal, and the interrupt request of the mobile terminal may be intercepted first, and the GIC or TZIC hands over the security request related to the wireless communication connection. Virtual core processing.
  • the mobile terminal divides physical memory into multiple memory areas by using a TTZSC (TrustZone Address Space Controller), and configures some memory areas by software running in a secure virtual core.
  • TTZSC TitanZone Address Space Controller
  • TZASC can prohibit programs running normal virtual memory from accessing the secure memory area.
  • the mobile terminal configures security attributes of the peripheral device through a TZPC (TrustZone Protection Controller), and divides the peripheral device into a secure peripheral or a non-secure peripheral, and the normal virtual memory runs. The program is prohibited from accessing secure peripherals.
  • TZPC TitanZone Protection Controller
  • the mobile terminal performs a preset policy processing on the communication content corresponding to the wireless communication connection by using the secure virtual core.
  • the communication content corresponding to the wireless communication connection includes communication content to be sent by the mobile terminal and communication content received by the mobile terminal.
  • the processing of the preset policy may include one or more of encryption, analog-to-digital conversion, encoding, modulation, and the like.
  • the processing of the preset policy may include one or more of decryption, demodulation, decoding, digital-to-analog conversion, and the like.
  • the processing of the preset policy is performed by the secure virtual core of the mobile terminal, and the program of the normal virtual core cannot access the communication content before the processing of the preset policy.
  • the operating code of the ordinary virtual memory is large, and there are many security vulnerabilities.
  • Secure virtual memory runs with a small amount of module code, making it easy to verify its security.
  • the operating system running by the normal virtual core can prevent the communication content before the processing of the preset policy, thereby preventing the operating system from eavesdropping on the communication content.
  • the mobile terminal outputs the processed communication content that passes the preset policy by using the secure virtual core.
  • the mobile terminal may send the communication content through the radio frequency module or the wireless network connection module. go with.
  • the communication content of the phone or the short message can be sent through the radio frequency module of the mobile terminal; the communication content such as mail, network voice call, video call, etc. can be sent through the wireless network connection module.
  • the network connection module of the embodiment of the present invention may be a WiFi module, configured to enable the mobile terminal to access the Internet.
  • the mobile terminal may output the received communication content.
  • the received communication content is voice, it may be output through an audio playback device (such as a microphone); if the received communication content is video, it may be output through a display screen and an audio playback device;
  • the received communication content is text or picture, which can be output through the display.
  • the shared memory between the secure virtual core and the common virtual core is shared.
  • the peripheral device required to be connected with the above wireless communication connection is set to prohibit program access of the common virtual core, and the communication content corresponding to the wireless communication connection is processed by the secure virtual core to perform a preset policy, and then the output of the secure virtual core is pre-processed.
  • the communication content of the policy processing can prevent the operating system and program running by the common virtual core from acquiring the communication content before processing, and can prevent the operating system from eavesdropping the communication content through the shared memory or related peripherals, thereby improving the security of communication of the mobile terminal.
  • FIG. 2 is a schematic flowchart diagram of another embodiment of a method for secure communication of a mobile terminal according to the present invention.
  • the secure communication method includes the following steps:
  • the mobile terminal sets the interrupt information related to the wireless communication connection that meets the preset security processing trigger condition to prohibit program access of the common virtual core.
  • the wireless communication connection may include, but is not limited to, a normal telephone connection, a network voice connection (including a voice connection between a network telephone or other real-time communication client), a network video connection, and the like.
  • some specific wireless communication type related interrupt signals may be set to prohibit program access of the common virtual core, such as a short message. , mail, etc.
  • the wireless communication connection meets a preset security processing trigger condition
  • the another mobile terminal that establishes a wireless communication connection with the mobile terminal may meet the security condition set by the mobile terminal, for example,
  • the wireless communication connection is a wireless communication connection between the mobile terminal and a friend in the address book.
  • the type of the wireless communication connection may be consistent with the setting of the mobile terminal.
  • the type of security, such as the wireless communication connection is a telephone connection.
  • the mobile terminal may set the foregoing interrupt information related to the wireless communication connection that meets the preset security processing trigger condition to block the program access of the common virtual core, and when the received preset meets the preset
  • the interrupt information is handed over to the secure virtual core for processing.
  • the mobile terminal may set, by using a GIC (Generic Interrupt Controller) or a TZIC (TrustZone Interrupt Controller, a TrustZone Interrupt Controller), the interrupt information related to the wireless communication connection to The security is interrupted so that it is only accessed in the secure virtual core.
  • GIC Generic Interrupt Controller
  • TZIC TrustZone Interrupt Controller, a TrustZone Interrupt Controller
  • the GIC or the TZIC is connected to all the interrupt sources of the mobile terminal, and the interrupt request of the mobile terminal may be intercepted first, and the GIC or TZIC hands over the security request related to the wireless communication connection. Virtual core processing.
  • the mobile terminal uses the secure virtual core and the common virtual core.
  • the shared memory between the shared memory and the peripheral device that is required to be called by the wireless communication connection is set to prohibit program access by the normal virtual core.
  • the application processor of the mobile terminal will receive an interrupt request for the incoming call information sent by the baseband processor.
  • a wireless communication connection is taken as an example of a voice connection.
  • the voice connection includes a telephone connection or a network voice connection.
  • the peripheral device to be called by the voice connection includes at least a recording device and an audio playback device.
  • the recording device and the audio playback device may be the same device, such as a microphone of the mobile terminal.
  • the CPU (Central Processing Unit) of the mobile terminal includes at least an application processor, and when the mobile terminal is a mobile phone, the CPU of the mobile terminal Also included is a baseband processor.
  • the application processor includes a secure virtual core and a common virtual core.
  • the secure virtual core and the common virtual core share the CPU, memory, peripheral devices, and bus of the mobile terminal.
  • the secure virtual memory monopolizes a part of the hardware resources of the application processor.
  • the program of the normal virtual kernel is prohibited from accessing the exclusive application processor resources of the secure virtual core.
  • the baseband processor runs the baseband system of the mobile terminal; the secure virtual core runs some security modules; the common virtual kernel runs the operating system of the mobile terminal, such as Android, iOS, Windows phone, and the like.
  • the mobile terminal may be a trustzone technology-based mobile terminal that adopts an ARM processor.
  • the mobile terminal divides physical memory into multiple memory areas by using a TTZSC (TrustZone Address Space Controller), and configures some memory areas by software running in a secure virtual core.
  • TTZSC TitanZone Address Space Controller
  • TZASC can prohibit programs running normal virtual memory from accessing the secure memory area.
  • the mobile terminal configures security attributes of the peripheral device through a TZPC (TrustZone Protection Controller), and divides the peripheral device into a secure peripheral or a non-secure peripheral, and the normal virtual memory runs. The program is prohibited from accessing secure peripherals.
  • TZPC TitanZone Protection Controller
  • the mobile terminal performs encryption processing on the recorded audio signal by using the secure virtual core.
  • the communication content corresponding to the wireless communication connection includes an audio signal recorded by the mobile terminal and an audio signal received by the mobile terminal.
  • the audio signal recorded by the mobile terminal is the content of the call that the user of the mobile terminal wants to communicate to the user of the other mobile terminal during the call, and the audio signal received by the mobile terminal is the other one during the call.
  • the user of the mobile terminal communicates the content of the call to the user of the mobile terminal.
  • the recorded audio signal is recorded by a recording device (such as a microphone) of the mobile terminal, and after the secure virtual core acquires the recorded audio signal from the recording device, it may be encrypted to prevent the mobile communication from being subjected to The content of the call leaked during the eavesdropping attack on the link.
  • a recording device such as a microphone
  • the mobile terminal uses the secure virtual core to perform an audio signal subjected to the encryption process.
  • the number is encoded to obtain an audio signal to be transmitted.
  • encoding the encrypted audio signal by using the secure virtual core may include: indicating, by the secure virtual core, the baseband processor pair of the mobile terminal The encrypted audio signal is subjected to analog-to-digital conversion, speech coding, channel coding, physical layer encryption, and modulation.
  • the baseband processor may also be instructed to perform other processing on the recorded audio signal, such as interleaving, equalization, filtering, and the like.
  • the encrypted audio signal is encoded by using a secure virtual core, which may specifically include encrypting the hardware resource or software resource pair of the secure virtual core.
  • the processed audio signal is subjected to analog to digital conversion, speech coding, channel coding, and physical layer encryption.
  • other processing such as interleaving, equalization, filtering, and the like may be performed on the recorded audio signal.
  • S205 Control, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal.
  • the wireless communication connection is a telephone connection
  • controlling, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal may include: The virtual core controls the radio frequency module of the mobile terminal to send the to-be-sent audio signal to the another mobile terminal.
  • the wireless communication connection is a network voice connection
  • controlling, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal may include:
  • the secure virtual core controls a wireless network connection module (eg, a WiFi module) of the mobile terminal to transmit the to-be-sent audio signal to the another mobile terminal.
  • the wireless network connection module can operate in a common virtual core of the mobile terminal. After the security virtual core obtains the to-be-transmitted audio signal, the audio signal to be transmitted may be transmitted to a common virtual core, and the normal virtual core is instructed to send the to-be-sent audio signal to the another mobile terminal through the wireless network connection module.
  • the mobile terminal decodes the audio signal by using the secure virtual core.
  • the movement The terminal receives the audio signal sent by the another mobile terminal through the mobile phone network through the radio frequency module.
  • Decoding the audio signal by the secure virtual core at this time may include: indicating, by the secure virtual core, a baseband processor to perform demodulation, channel decoding, physical layer decryption, voice decoding, and digital-to-analog conversion on the received audio signal. Wait.
  • other processing such as equalization, channel separation, deinterleaving, and the like may be performed on the received audio signal.
  • the mobile terminal receives an audio signal sent by the another mobile terminal through the Internet through a wireless network connection module.
  • the wireless network connection module may be operated in a common virtual core of the mobile terminal, and the wireless network connection module controlled by the common virtual core receives the audio signal sent by the another mobile terminal. Then, the received audio signal is transmitted to the secure virtual core for processing.
  • Decoding the audio signal by the secure virtual core at this time may include performing channel decoding, physical layer decryption, voice decoding, and digital-to-analog conversion on the received audio signal by using the secure virtual core.
  • other processing such as equalization, channel separation, deinterleaving, and the like may be performed on the received audio signal.
  • the mobile terminal performs decryption processing on the decoded audio signal by using the secure virtual core to obtain an audio signal to be played.
  • the mobile terminal for the received audio signal, before the other mobile terminal encodes and transmits the audio signal, in order to prevent the content of the call from being leaked when subjected to a wiretapping attack on the mobile communication link,
  • the upper layer encryption for the received audio signal, before the other mobile terminal encodes and transmits the audio signal, in order to prevent the content of the call from being leaked when subjected to a wiretapping attack on the mobile communication link,
  • the upper layer encryption The mobile terminal receives the audio signal subjected to the upper layer encryption processing, and after decoding it, it also needs to perform decryption processing.
  • the mobile terminal controls the audio playback device to play the to-be-played audio signal by using the secure virtual core.
  • the audio playback device of the mobile terminal can be controlled to be played by the secure virtual core.
  • the audio playback device of the mobile terminal may be a microphone.
  • the mobile terminal when a voice connection is established between the mobile terminal and another mobile terminal, and the voice connection meets a preset security processing trigger condition, the mobile terminal connects the secure virtual core and the common virtual core.
  • the shared memory between the shared memory and the recording device, the audio playback device, and the like are set to prohibit program access of the normal virtual core, and the mobile terminal is recorded through the secure virtual kernel.
  • the audio signal and the received audio signal are processed, and then the processed communication content is output by using the secure virtual core, thereby preventing the operating system and program running by the normal virtual core from acquiring the pre-processing communication content, and also preventing the operating system from sharing.
  • the memory or related peripherals eavesdrop on the communication content and improve the security of the communication of the mobile terminal.
  • FIG. 3 is a schematic flowchart diagram of still another embodiment of a method for secure communication of a mobile terminal according to the present invention.
  • the secure communication method includes the following steps:
  • the mobile terminal sets the interrupt information related to the wireless communication connection that meets the preset security processing trigger condition to prohibit program access of the common virtual core.
  • step S201 in the embodiment shown in FIG. 2 may be referred to, and details are not described herein.
  • the mobile terminal uses the secure virtual core and the common virtual core.
  • the shared memory between the shared memory and the peripheral device that is required to be called by the wireless communication connection is set to prohibit program access by the normal virtual core.
  • a program interface or when detecting that the mobile terminal selects the video call option of the real-time communication client, it may be considered that a video call connection is established between the mobile terminal and another mobile terminal.
  • the application processor will detect an interrupt request for the video call connection.
  • a wireless communication connection is taken as an example of a video call connection.
  • the peripheral device to be called by the video call connection includes a video recording device, a recording device, an audio playback device, and a display screen.
  • the recording device may be a camera of the mobile terminal, and the recording device and the audio playback device may be the same device, for example, The microphone of the mobile terminal.
  • the CPU (Central Processing Unit) of the mobile terminal includes at least an application processor, and when the mobile terminal is a mobile phone, the CPU of the mobile terminal Also included is a baseband processor.
  • the application processor includes a secure virtual core and a common virtual core.
  • the secure virtual core and the common virtual core share the CPU, memory, peripheral devices, and bus of the mobile terminal.
  • the secure virtual memory monopolizes a part of the hardware resources of the application processor.
  • the program of the normal virtual kernel is prohibited from accessing the exclusive application processor resources of the secure virtual core.
  • the baseband processor runs the baseband system of the mobile terminal; the secure virtual core runs some security modules; the common virtual kernel runs the operating system of the mobile terminal, such as Android, iOS, Windows phone, and the like.
  • the mobile terminal may be a trustzone technology-based mobile terminal that adopts an ARM processor.
  • the mobile terminal may divide the physical memory into multiple memory areas by using a TTZSC (TrustZone Address Space Controller), and configure some memory areas by running software in the secure virtual core.
  • TTZSC TitanZone Address Space Controller
  • TZASC can prevent programs running from normal virtual memory from accessing the secure memory area.
  • the mobile terminal configures security attributes of the peripheral device through a TZPC (TrustZone Protection Controller), and divides the peripheral device into a secure peripheral or a non-secure peripheral, and the normal virtual memory runs. The program is prohibited from accessing secure peripherals.
  • TZPC TitanZone Protection Controller
  • the mobile terminal When the communication content corresponding to the wireless communication connection is an audio and video signal recorded by the mobile terminal, the mobile terminal performs encryption processing on the recorded audio and video signal by using the secure virtual core.
  • the communication content corresponding to the wireless communication connection includes an audio and video signal recorded by the mobile terminal and an audio and video signal received by the mobile terminal.
  • the audio and video signals recorded by the mobile terminal include a video signal recorded by a video recording device of the mobile terminal and an audio signal recorded by a recording device of the mobile terminal.
  • the mobile terminal may perform encryption processing on the video and video signals. Prevents leakage of call content when eavesdropping attacks on mobile communication links.
  • the mobile terminal uses the secure virtual core to perform audio and video processing through the encryption process.
  • the signal is encoded to obtain an audio and video signal to be transmitted.
  • encoding the audio and video signals subjected to the encryption process by using the secure virtual core may include: encoding and encrypting the encrypted video signal by using the secure virtual core, and utilizing The secure virtual core performs analog-to-digital conversion, speech coding, channel coding, physical layer encryption, and the like on the encrypted audio signal.
  • the encoding standard of the video signal may be selected according to the definition requirement or the compression ratio requirement of the video call connection, such as H.261, H.262, H.263, H.264, MPEG-2, MPEG-4, etc. The invention is not limited thereto.
  • the recorded audio signal may be interleaved, equalized, filtered, and the like.
  • the to-be-sent audio and video signal is sent to the another mobile terminal by using a wireless network connection module of the mobile terminal.
  • the wireless network connection module in order to secure a secure environment of the secure virtual core, can operate in a common virtual core of the mobile terminal.
  • the secure virtual core may transmit the audio and video signals to be sent to the normal virtual core, and instruct the normal virtual core to send the audio and video signals to be sent to the another mobile terminal via the wireless network connection module via the Internet.
  • the wireless network connection module may be a WiFi module, configured to enable the mobile terminal to access the Internet.
  • the mobile terminal decodes the received audio and video signal by using the secure virtual core.
  • the mobile terminal receives an audio and video signal sent by the another mobile terminal through a wireless network connection module.
  • the wireless network connection module may run in a common virtual core of the mobile terminal.
  • the wireless network connection module is controlled by the normal virtual core to receive the audio and video signals sent by the other mobile terminal, and then the received audio and video signals are transmitted to the secure virtual core for processing.
  • the received audio and video signals may include video signals and audio signals.
  • the decoding, by the secure virtual core, the received audio and video signal may include: the secure virtual core decoding the received video signal, specifically, the video signal in the received audio and video signal. Physical layer decryption and video decoding; the secure virtual core decoding reception
  • the audio frequency signal to be obtained is specifically physical layer decryption, channel decoding, voice decoding, and digital-to-analog conversion of the audio signal in the received audio and video signal.
  • the decoding standard of the video signal may include H.261, H.262, H.263, H.264, MPEG-2, MPEG-4, etc., depending on the coding standard selected when the video is encoded.
  • other processes such as equalization, channel separation, deinterleaving, and the like may be performed on the audio signals in the received audio and video signals.
  • the mobile terminal may separately decode the received audio signal and the received video signal by using the secure virtual core to obtain a decoded audio signal and a decoded video signal.
  • the mobile terminal performs decryption processing on the decoded audio and video signal by using the secure virtual core to obtain an audio and video signal to be played.
  • the other mobile terminal prevents the call content from being subjected to a wiretapping attack on the mobile communication link before being encoded and compressed and transmitted. Leaked, first encrypted it.
  • the mobile terminal receives the audio and video signals subjected to the upper layer encryption processing, and after decoding by the secure virtual core, it also needs to decrypt the processing through the secure virtual core.
  • the mobile terminal may decrypt the decoded audio signal and the decoded video signal by using the secure virtual core to obtain an audio signal to be played and a video signal to be played.
  • the mobile terminal controls the audio playback device and the display screen to play the to-be-played audio and video signal through the secure virtual core.
  • the audio playback device and the display screen of the mobile terminal can be controlled to play through the secure virtual core.
  • the audio signal to be played in the to-be-played audio and video signal can be played by an audio playing device (such as a microphone) of the mobile terminal, and the video signal to be played in the to-be-played audio and video signal can pass through the mobile terminal.
  • the display shows playback.
  • the mobile terminal when a video call connection is established between the mobile terminal and another mobile terminal, and the video call connection meets a preset security processing trigger condition, uses the secure virtual core and the common virtual The shared memory between the cores and related peripherals such as recording devices, recording devices, audio playback devices, display screens, etc.
  • the secure virtual core is used to output the processed communication content, thereby preventing the operating system and program running by the common virtual core from acquiring the communication content before processing, and preventing the operating system from eavesdropping the communication content through the shared memory or related peripherals, thereby improving the mobile terminal.
  • FIG. 4 is a schematic structural diagram of an embodiment of a mobile terminal provided by the present invention.
  • the mobile terminal includes: a first setting unit 401, a processing unit 402, and an output unit 403, where:
  • the first setting unit 401 is configured to: when the wireless communication connection is established between the mobile terminal and another mobile terminal, and the wireless communication connection meets a preset security processing trigger condition, the secure virtual core and the The shared memory between the normal virtual cores and the peripheral devices required to be called by the wireless communication connection are set to prohibit program access by the normal virtual core.
  • the CPU (Central Processing Unit) of the mobile terminal includes at least an application processor.
  • the CPU of the mobile terminal further includes a baseband processor.
  • the application processor includes a secure virtual core and a common virtual core.
  • the secure virtual core and the common virtual core share the CPU, memory, peripheral devices, and bus of the mobile terminal.
  • the secure virtual memory monopolizes a part of the hardware resources of the application processor.
  • the program of the normal virtual kernel is prohibited from accessing the exclusive application processor resources of the secure virtual core.
  • the wireless communication connection may include, but is not limited to, a normal telephone connection, a network voice connection (including a voice connection between a network telephone or other real-time communication client), a network video connection, and the like.
  • the embodiment of the present invention may further connect the secure virtual core and the common virtual core when the mobile terminal and the another mobile terminal perform short message communication or mail communication.
  • the peripheral device called for shared memory and SMS communication or mail communication is set to prohibit program access by the normal virtual kernel.
  • the peripheral device required to be called by SMS communication or mail communication may include one or more of a button, a keyboard, a tablet, and a display.
  • some interrupt signals related to wireless communication may be detected. It is determined that a wireless communication connection will be established between the mobile terminal and another mobile terminal. For example, when the another mobile terminal calls, the application processor will receive an interrupt request for the incoming call information sent by the baseband processor.
  • the wireless communication connection meets a preset security processing trigger condition
  • the another mobile terminal that establishes a wireless communication connection with the mobile terminal may meet the security condition set by the mobile terminal, for example,
  • the wireless communication connection is a wireless communication connection between the mobile terminal and a friend in the address book.
  • the type of the wireless communication connection conforms to a security type set by the mobile terminal, for example, the wireless communication connection is a telephone connection.
  • the wireless communication connection related interrupt information that meets the preset security processing trigger condition may be set to prohibit program access of the common virtual core. For example, when any incoming call signal is detected or an incoming call signal of a friend in the address book is detected, the baseband system sends an interrupt request for the incoming call information to the application processor, and the interrupt request of the incoming call information is preset to prohibit the normal virtual core. Access, so after the application processor receives the interrupt request for the incoming call information, the interrupt request of the incoming call information will be processed through the secure virtual core.
  • the mobile terminal may be a mobile terminal based on the trustzone technology using an ARM processor.
  • SoC system-on-chip
  • the system-on-chip (SoC) of the mobile terminal integrates a CPU, a direct memory access (DMA), a secure random access memory (Secure RAM), and a secure read-only memory (Secure Boot ROM) for booting.
  • interrupt controller GIC/TZIC
  • TZASC Direct memory access memory
  • TZPC Dynamic Memory Controller
  • DMC Dynamic Random Access Memory
  • DRAM Dynamic Random Access Memory
  • the components in the SoC are connected by an Advanced eXtensible Interface (AXI) bus.
  • AXI Advanced eXtensible Interface
  • the secure RAM and the secure ROM are isolated using hardware and software mechanisms that store the modules that the secure virtual core runs.
  • TZASC is used to divide the shared memory (ie DRAM) security attributes. It can set a part of the DRAM to be secure, and the rest is set to be non-secure.
  • DRAM shared memory
  • the SoC sets the security properties of the peripheral device through the TZPC and communicates with the peripheral device through the AXI-to-APB bridge.
  • AXI-to-APB is aware of the security attributes of transactions currently accessing peripherals.
  • AXI-to-APB rejects when a transaction of a normal virtual core accesses a peripheral whose security is set to secure. Must visit.
  • the SoC sets the interrupt information related to the wireless communication connection as a security interrupt by a GIC (Generic Interrupt Controller) or a TZIC (TrustZone Interrupt Controller), so that it is only in the secure virtual core. access.
  • the GIC or the TZIC is connected to all the interrupt sources of the mobile terminal, and the interrupt request of the mobile terminal may be intercepted first, and the GIC or TZIC hands over the security request related to the wireless communication connection. Virtual core processing.
  • the mobile terminal when the mobile terminal is a mobile phone, the mobile terminal includes an application processor and a baseband processor, and the application processor includes a secure virtual core S and a normal virtual kernel NS, and the secure virtual core and The normal virtual core shares the CPU, memory, peripherals, and bus of the mobile terminal.
  • the program of the normal virtual core is prohibited from accessing the hardware resources of the secure virtual core.
  • the baseband processor runs the baseband system of the mobile terminal; the secure virtual core runs some security modules; the common virtual kernel runs the operating system of the mobile terminal, such as Android, iOS, Windows phone, and the like.
  • the peripheral device to be called at least includes a recording device and an audio playback device.
  • the recording device and the audio device may be the same device, such as a microphone of the mobile terminal.
  • the peripheral device to be called at least includes a video recording device, a recording device, an audio playback device, and a display screen, such as a camera, a microphone, and a display screen of the mobile terminal.
  • the mobile terminal divides physical memory into multiple memory areas by using a TTZSC (TrustZone Address Space Controller), and configures some memory areas by software running in a secure virtual core.
  • TTZSC TitanZone Address Space Controller
  • TZASC can prohibit programs running normal virtual memory from accessing the secure memory area.
  • the mobile terminal configures security attributes of the peripheral device through a TZPC (TrustZone Protection Controller), and divides the peripheral device into a secure peripheral or a non-secure peripheral, and the normal virtual memory runs. The program is prohibited from accessing secure peripherals.
  • TZPC TitanZone Protection Controller
  • the processing unit 402 is configured to communicate with the wireless communication connection by using the secure virtual core.
  • the content of the letter is processed by a preset policy.
  • the communication content corresponding to the wireless communication connection includes communication content to be sent by the mobile terminal and communication content received by the mobile terminal.
  • the processing of the preset policy may include one or more of encryption, analog-to-digital conversion, encoding, modulation, and the like.
  • the processing of the preset policy may include one or more of decryption, demodulation, decoding, digital-to-analog conversion, and the like.
  • the processing of the preset policy is performed by the secure virtual core of the mobile terminal, and the program of the normal virtual core cannot access the communication content before the processing of the preset policy.
  • the operating code of the ordinary virtual memory is large, and there are many security vulnerabilities.
  • Secure virtual memory runs with a small amount of module code, making it easy to verify its security.
  • the operating system running by the normal virtual core can prevent the communication content before the processing of the preset policy, thereby preventing the operating system from eavesdropping on the communication content. .
  • the output unit 403 is configured to output the processed communication content that passes the preset policy by using the secure virtual core.
  • the mobile terminal may send the radio communication module or the wireless network connection module.
  • the communication content of the phone or the short message can be sent through the radio module of the mobile terminal; the communication content such as mail, network voice call, video call, etc. can be sent through the network connection module.
  • the network connection module of the embodiment of the present invention may be a WiFi module, configured to enable the mobile terminal to access the Internet.
  • the mobile terminal may output the received communication content.
  • the received communication content is voice, it may be output through an audio playback device (such as a microphone); if the received communication content is video, it may be output through a display screen and an audio playback device;
  • the received communication content is text or picture, which can be output through the display.
  • the shared memory between the secure virtual core and the common virtual core is shared.
  • the peripheral device to be called in connection with the above wireless communication connection is set to prohibit program access of the normal virtual core, and corresponds to the above wireless communication connection through the secure virtual core.
  • the communication content is processed by the preset policy, and the secure virtual core is used to output the communication content processed by the preset policy, which can prevent the operating system and the program running by the common virtual kernel from acquiring the communication content before the processing, and also prevent the operating system from sharing.
  • the memory or related peripherals eavesdrop on the communication content and improve the security of the communication of the mobile terminal.
  • FIG. 6 is a schematic structural diagram of still another embodiment of a mobile terminal provided by the present invention.
  • the mobile terminal includes: a first setting unit 601, a processing unit 602, an output unit 603, and a second setting unit 604, where:
  • the second setting unit 604 is configured to set the interrupt information related to the wireless communication connection that meets the preset security processing trigger condition to prohibit program access of the common virtual core.
  • the wireless communication connection may include, but is not limited to, a normal telephone connection, a network voice connection (including a voice connection between a network telephone or other real-time communication client), a network video connection, and the like.
  • some specific wireless communication type related interrupt signals may be set to prohibit program access of the common virtual core, such as a short message. , mail, etc.
  • the wireless communication connection meets a preset security processing trigger condition
  • the another mobile terminal that establishes a wireless communication connection with the mobile terminal may meet the security condition set by the mobile terminal, for example,
  • the wireless communication connection is a wireless communication connection between the mobile terminal and a friend in the address book.
  • the type of the wireless communication connection conforms to a security type set by the mobile terminal, for example, the wireless communication connection is a telephone connection.
  • the mobile terminal may set the foregoing interrupt information related to the wireless communication connection that meets the preset security processing trigger condition to block the program access of the common virtual core, and when the received preset meets the preset
  • the interrupt information is handed over to the secure virtual core for processing.
  • the second setting unit 604 can set the interrupt information related to the wireless communication connection by using a GIC (Generic Interrupt Controller) or a TZIC (TrustZone Interrupt Controller). For security interrupts, it is only accessed in the secure virtual core.
  • the GIC or the TZIC is connected to all the interrupt sources of the mobile terminal, and the interrupt request of the mobile terminal may be intercepted first, and the GIC or TZIC hands over the security request related to the wireless communication connection. Virtual core processing.
  • a first setting unit 601 configured to: when a wireless communication connection is established between the mobile terminal and another mobile terminal, and the wireless communication connection meets a preset security processing trigger condition, the secure virtual core and the The shared memory between the normal virtual cores and the peripheral devices required to be called by the wireless communication connection are set to prohibit program access by the normal virtual core.
  • the foregoing first setting unit 601 can perform the implementation performed by the first setting unit 401 described in the embodiment shown in FIG. 4.
  • the wireless communication connection is a voice connection, including a telephone connection or a network voice connection.
  • the peripheral device to be called by the wireless communication connection includes a recording device and an audio playback device, and the first setting unit 601 may be specifically configured to share the memory between the secure virtual core and the common virtual core.
  • the recording device and the audio playback device of the mobile terminal are set to prohibit program access by the normal virtual core.
  • the processing unit 602 described above may perform the implementations performed by the processing unit 402 described in the embodiment illustrated in FIG.
  • the processing unit 602 can include a first encryption subunit 6021, a first coding subunit 6022, a first decoding subunit 6023, and a first decryption subunit 6024, where:
  • the first encryption subunit 6021 is configured to perform encryption processing on the recorded audio signal by the secure virtual core when the communication content is an audio signal recorded by the recording device.
  • the communication content corresponding to the wireless communication connection includes an audio signal recorded by the mobile terminal and an audio signal received by the mobile terminal.
  • the audio signal recorded by the mobile terminal is the content of the call that the user of the mobile terminal wants to communicate to the user of the other mobile terminal during the call, and the audio signal received by the mobile terminal is the other one during the call.
  • the user of the mobile terminal communicates the content of the call to the user of the mobile terminal.
  • the recorded audio signal is recorded by a recording device (such as a microphone) of the mobile terminal, and after the secure virtual core acquires the recorded audio signal from the recording device, the audio signal may be encrypted by the first encryption subunit 6021.
  • a recording device such as a microphone
  • the audio signal may be encrypted by the first encryption subunit 6021.
  • the first coding sub-unit 6022 is configured to encode the audio signal subjected to the encryption process by using the secure virtual core to obtain an audio signal to be transmitted.
  • encoding the encrypted audio signal by using the secure virtual core may include: indicating, by the secure virtual core, the baseband processor pair of the mobile terminal The encrypted audio signal is subjected to analog-to-digital conversion, speech coding, channel coding, physical layer encryption, and modulation.
  • the baseband processor may also be instructed to perform other processing on the recorded audio signal, such as interleaving, equalization, filtering, and the like.
  • the encrypted audio signal is encoded by using a secure virtual core, which may specifically include encrypting the hardware resource or software resource pair of the secure virtual core.
  • the processed audio signal is subjected to analog to digital conversion, speech coding, channel coding, and physical layer encryption.
  • other processing such as interleaving, equalization, filtering, and the like may be performed on the recorded audio signal.
  • the first decoding subunit 6023 is configured to decode the audio signal by the secure virtual core when the communication content is an audio signal received by the mobile terminal.
  • the mobile terminal when the wireless communication connection is a telephone connection, receives an audio signal sent by the another mobile terminal through a mobile phone network through a radio frequency module.
  • Decoding the audio signal by the secure virtual core at this time may include: indicating, by the secure virtual core, a baseband processor to perform demodulation, channel decoding, physical layer decryption, voice decoding, and digital-to-analog conversion on the received audio signal. Wait.
  • other processing such as equalization, channel separation, deinterleaving, and the like may be performed on the received audio signal.
  • the mobile terminal when the wireless communication request is a network voice connection, receives an audio signal sent by the another mobile terminal through the Internet through a wireless network connection module.
  • the wireless network connection module may be operated in a common virtual core of the mobile terminal, and the wireless network connection module controlled by the common virtual core receives the audio signal sent by the another mobile terminal. Then, the received audio signal is transmitted to the secure virtual core for processing.
  • Decoding the audio signal by the secure virtual core at this time may include performing channel decoding, physical layer decryption, voice decoding, and digital-to-analog conversion on the received audio signal through the secure virtual core.
  • other processing such as equalization, channel separation, deinterleaving, and the like may be performed on the received audio signal.
  • a first decryption subunit 6024 configured to decode the demodulation by using the secure virtual core pair
  • the subsequent audio signal is decrypted to obtain an audio signal to be played.
  • the mobile terminal for the received audio signal, before the other mobile terminal encodes and transmits the audio signal, in order to prevent the content of the call from being leaked when subjected to a wiretapping attack on the mobile communication link,
  • the upper layer encryption for the received audio signal, before the other mobile terminal encodes and transmits the audio signal, in order to prevent the content of the call from being leaked when subjected to a wiretapping attack on the mobile communication link,
  • the upper layer encryption The mobile terminal receives the audio signal subjected to the upper layer encryption processing, and after decoding it, the first decryption sub-unit 6024 decrypts the same.
  • the output unit 603 described above may perform the implementations performed by the output unit 403 described in the embodiment of FIG.
  • the output unit 403 is further configured to: control, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal; or control by the secure virtual core.
  • the audio playback device plays the audio signal to be played.
  • the wireless communication connection is a telephone connection
  • controlling, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal may include: The virtual core controls the radio frequency module of the mobile terminal to send the to-be-sent audio signal to the another mobile terminal.
  • the wireless communication connection is a network voice connection
  • controlling, by the secure virtual core, the mobile terminal to send the to-be-sent audio signal to the another mobile terminal may include:
  • the secure virtual core controls a wireless network connection module (eg, a WiFi module) of the mobile terminal to transmit the to-be-sent audio signal to the another mobile terminal.
  • the wireless network connection module can operate in a common virtual core of the mobile terminal. After the security virtual core obtains the to-be-transmitted audio signal, the audio signal to be transmitted may be transmitted to a common virtual core, and the normal virtual core is instructed to send the to-be-sent audio signal to the another mobile terminal through the wireless network connection module.
  • the audio playback device of the mobile terminal can be controlled to be played by the secure virtual core.
  • the audio playback device of the mobile terminal may be a microphone.
  • the mobile terminal when a voice connection is established between the mobile terminal and another mobile terminal, and the voice connection meets a preset security processing trigger condition, the mobile terminal connects the secure virtual core and the common virtual core.
  • the shared memory between the shared memory and the recording device, the audio playback device, and the like are set to prohibit program access of the normal virtual core, and are acquired by the secure virtual core and the baseband processor of the mobile terminal, and the audio signal is processed, and then passed through Processed audio
  • the signal is sent to another mobile terminal or output, which prevents the operating system and program running by the common virtual core from acquiring the communication content before processing, and also prevents the operating system from eavesdropping the communication content through the shared memory or related peripherals, thereby improving the security of the communication of the mobile terminal. Sex.
  • FIG. 7 is a schematic structural diagram of still another embodiment of a mobile terminal according to the present invention.
  • the mobile terminal includes: a first setting unit 701, a processing unit 702, an output unit 703, and a second setting unit 704, where:
  • the second setting unit 704 is configured to set the wireless communication connection-related interrupt information that meets the preset security processing trigger condition to prohibit program access of the normal virtual core.
  • the foregoing second setting unit 704 can be implemented by the second setting unit 604 described in the embodiment shown in FIG. 6, and details are not described herein.
  • the first setting unit 701 is configured to: when the wireless communication connection is established between the mobile terminal and another mobile terminal, and the wireless communication connection meets a preset security processing trigger condition, the secure virtual core and the The shared memory between the normal virtual cores and the peripheral devices required to be called by the wireless communication connection are set to prohibit program access by the normal virtual core.
  • the first setting unit 701 may perform the implementation performed by the first setting unit 401 described in the embodiment shown in FIG. 4.
  • the wireless communication connection is a video call connection
  • the peripheral device required to be called by the wireless communication connection includes a video recording device, a recording device, an audio playback device, and a display screen.
  • the first setting unit 701 may be specifically configured to set a shared memory between the secure virtual core and the common virtual core, a recording device of the mobile terminal, a recording device, an audio playback device, and a display screen as prohibited. Program access to a normal virtual kernel.
  • step S302 for a specific implementation manner of establishing a video call connection between the mobile terminal and another mobile terminal, refer to the related description of step S302 in the embodiment shown in FIG.
  • processing unit 702 can perform the implementations performed by processing unit 402 described in the embodiment illustrated in FIG.
  • the processing unit 702 may include a first encryption subunit 7021, a second encryption subunit 7022, a first coding subunit 7023, a second coding subunit 7024, a first decoding subunit 7025, and a second decoding sub.
  • Unit 7026, first decryption subunit 7027 and second decryption subunit 7028 wherein:
  • a first encryption subunit 7021 configured to: when the communication content is an audio signal recorded by the recording device, the mobile terminal encrypts the recorded audio signal by using the secure virtual core deal with.
  • the second encryption subunit 7021 is configured to perform encryption processing on the recorded video signal by using the secure virtual core when the communication content is a video signal recorded by the recording device.
  • the communication content corresponding to the wireless communication connection includes an audio signal recorded by the mobile terminal, a video signal recorded by the mobile terminal, and an audio signal received by the mobile terminal. And a video signal received by the mobile terminal.
  • the mobile terminal can perform the video call and the recorded video signal. Encryption processing to prevent leakage of call content when eavesdropping attacks on mobile communication links.
  • the audio signal in the audio and video signal recorded by the mobile terminal may be encrypted by the first encryption subunit 7021, and the audio and video recorded by the second encryption subunit 7022 on the mobile terminal.
  • the video signal in the signal is encrypted.
  • the first encoding subunit 7023 is configured to encode the audio signal subjected to the encryption process by using the secure virtual core to obtain an audio signal to be transmitted.
  • the second encoding subunit 7024 is configured to encode the video signal subjected to the encryption process by using the secure virtual core to obtain a video signal to be transmitted.
  • the first coding sub-unit 7023 may be specifically configured to perform analog-to-digital conversion, voice coding, channel coding, physical layer encryption, and the like on the encrypted audio signal.
  • the first coding sub-unit 7023 may also perform interleaving, equalization, filtering, and the like on the recorded audio signal.
  • the second encoding sub-unit 7024 can be specifically configured to encode and physically encrypt the encrypted video signal.
  • the encoding standard of the video signal may be selected according to the definition requirement or the compression ratio requirement of the video call connection, such as H.261, H.262, H.263, H.264, MPEG-2, MPEG-4, etc. The invention is not limited thereto.
  • the first decoding subunit 7025 is configured to decode the audio signal by the secure virtual core when the communication content is an audio signal received by the mobile terminal.
  • the second decoding subunit 7026 is configured to decode the received video signal by the secure virtual core when the communication content is a video signal received by the mobile terminal.
  • the mobile terminal receives an audio signal and a video signal sent by the another mobile terminal through a wireless network connection module.
  • the wireless network connection module may run in a common virtual core of the mobile terminal. At this time, the wireless network connection module is controlled by the normal virtual core to receive the audio signal and the video signal sent by the other mobile terminal, and then the received audio signal and the video signal are transmitted to the secure virtual core for processing.
  • the first decoding sub-unit 7025 may be specifically configured to perform physical layer decryption, channel decoding, voice decoding, and digital-to-analog conversion on the received audio signal.
  • the first decoding subunit 7025 may perform equalization, channel separation, deinterleaving, and the like on the audio signals in the received audio and video signals.
  • the second decoding subunit 7026 may be specifically configured to perform physical layer decryption and video decoding on the received video signal; wherein the decoding standard of the video signal may include H.261, H.262, H. 263, H.264, MPEG-2, MPEG-4, etc., depending on the coding standard selected when the video is encoded.
  • the first decryption subunit 7027 is configured to perform decryption processing on the demodulated and decoded audio signal by using the secure virtual core to obtain an audio signal to be played.
  • the second decryption subunit 7028 is configured to perform decryption processing on the decoded video signal by using the secure virtual core to obtain a video signal to be played.
  • the other mobile terminal prevents the eavesdropping attack on the mobile communication link before it is encoded and compressed and transmitted.
  • the content of the call was leaked, and the upper layer was encrypted first.
  • the mobile terminal receives the audio signal and the video signal subjected to the upper layer encryption processing, and after being decoded by the secure virtual core, it also needs to decrypt the processing through the secure virtual core.
  • the audio signal received by the mobile terminal may be decrypted by the first decryption subunit 7027, and the video signal received by the mobile terminal may be decrypted by the second decryption subunit 7028.
  • the output unit 703 described above may perform the implementations performed by the output unit 403 described in the embodiment of FIG.
  • the wireless communication connection is a video call connection
  • the output unit 703 is specifically configured to: control the shift by using the secure virtual core. Transmitting, by the mobile terminal, the to-be-transmitted audio signal and the to-be-transmitted video signal to the another mobile terminal; or controlling, by the secure virtual core, the audio playback device to play the to-be-played audio device, by using the security
  • the virtual core controls the display screen to play the video signal to be played.
  • the to-be-transmitted audio signal and the to-be-sent video signal may be sent to the another mobile terminal by using a wireless network connection module of the mobile terminal.
  • the wireless network connection module in order to secure a secure environment of the secure virtual core, can operate in a common virtual core of the mobile terminal.
  • the secure virtual core of the mobile terminal may transmit the to-be-sent audio signal and the to-be-sent video signal to the normal virtual core, and instruct the common virtual core to send the foregoing to the another mobile terminal via the wireless network connection module via the Internet.
  • the wireless network connection module may be a WiFi module, configured to enable the mobile terminal to access the Internet.
  • the audio playback device and the display of the mobile terminal can be controlled by the secure virtual core.
  • the screen plays.
  • the audio signal to be played can be played by an audio playing device (such as a microphone) of the mobile terminal, and the video signal to be played can be displayed and played through a display screen of the mobile terminal.
  • the secure virtual core and the common virtual core are
  • the shared memory and related peripherals such as a recording device, a recording device, an audio playback device, a display screen, and the like are set to prohibit program access of the normal virtual core, and the audio and video signals and the received audio and video recorded by the secure virtual kernel to the mobile terminal are
  • the signal is processed, and the processed virtual communication kernel is used to output the processed communication content, thereby preventing the operating system and program running by the common virtual core from acquiring the communication content before processing, and preventing the operating system from eavesdropping the communication content through the shared memory or related peripherals.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Flash disk, Read-Only Memory (ROM), Random Access Memory (RAM), disk or optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Telephone Function (AREA)

Abstract

Les modes de réalisation de la présente invention concernent un procédé de communication sécurisé d'un terminal mobile, et un terminal mobile. Le procédé de communication sécurisé comprend les étapes suivantes : lorsqu'une connexion de communication sans fil doit être établie entre un terminal mobile et un autre terminal mobile, et que la connexion de communication sans fil satisfait une condition de déclenchement de traitement de sécurité prédéfinie, régler une mémoire partagée entre un noyau virtuel sécurisé et un noyau virtuel commun et un dispositif périphérique devant être utilisé pour la connexion de communication sans fil comme étant inaccessible pour un programme du noyau virtuel commun ; effectuer, par l'intermédiaire du noyau virtuel de sécurité, le traitement d'une politique prédéfinie sur un contenu de communication correspondant à la connexion de communication sans fil ; délivrer, à l'aide du noyau virtuel de sécurité, le contenu de communication traité selon la politique prédéfinie. L'utilisation du mode de réalisation de la présente invention peut empêcher un programme et un système d'exploitation exécutés par le noyau virtuel commun d'acquérir le contenu de communication non traité, et peut également empêcher un système d'exploitation d'intercepter le contenu de communication par l'intermédiaire de la mémoire partagée ou d'un dispositif périphérique associé, ce qui permet d'augmenter la sécurité de communication d'un terminal mobile.
PCT/CN2015/098761 2015-04-30 2015-12-24 Procédé de communication de terminal mobile, et terminal mobile WO2016173284A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
KR1020177034118A KR101940164B1 (ko) 2015-04-30 2015-12-24 이동 단말을 위한 통신 방법 및 이동 단말
EP15890658.6A EP3282735A4 (fr) 2015-04-30 2015-12-24 Procédé de communication de terminal mobile, et terminal mobile
US15/795,491 US10638311B2 (en) 2015-04-30 2017-10-27 Communication method for mobile terminal and mobile terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510217336.8A CN106211144B (zh) 2015-04-30 2015-04-30 一种移动终端的通信方法及移动终端
CN201510217336.8 2015-04-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/795,491 Continuation US10638311B2 (en) 2015-04-30 2017-10-27 Communication method for mobile terminal and mobile terminal

Publications (1)

Publication Number Publication Date
WO2016173284A1 true WO2016173284A1 (fr) 2016-11-03

Family

ID=57199552

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/098761 WO2016173284A1 (fr) 2015-04-30 2015-12-24 Procédé de communication de terminal mobile, et terminal mobile

Country Status (5)

Country Link
US (1) US10638311B2 (fr)
EP (1) EP3282735A4 (fr)
KR (1) KR101940164B1 (fr)
CN (1) CN106211144B (fr)
WO (1) WO2016173284A1 (fr)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107168747B (zh) * 2017-05-27 2020-12-29 努比亚技术有限公司 移动终端配置的区分方法、装置及计算机可读存储介质
CN114448553B (zh) * 2020-11-05 2024-02-13 成都鼎桥通信技术有限公司 防窃听方法、装置、设备以及存储介质
US12079379B2 (en) * 2020-12-03 2024-09-03 Huawei Technologies Co., Ltd. Peripheral component interconnect express protection controller

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102271191A (zh) * 2011-08-31 2011-12-07 宇龙计算机通信科技(深圳)有限公司 移动终端和数据访问方法
US20120216242A1 (en) * 2011-02-22 2012-08-23 PCTEL Secure LLC Systems and Methods for Enhanced Security in Wireless Communication
CN103197991A (zh) * 2012-01-09 2013-07-10 Lg电子株式会社 移动终端及其控制方法
CN103577740A (zh) * 2012-08-02 2014-02-12 中国移动通信集团公司 一种实现安全通信的方法和智能移动终端

Family Cites Families (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1585539A (zh) 2004-06-08 2005-02-23 山东超越数控电子有限公司 手机的加密方法
US8626177B2 (en) * 2006-05-17 2014-01-07 Lg Electronics Inc. Method of implementing superposition coding for a forward link in a wireless communication system
US8626115B2 (en) * 2009-01-28 2014-01-07 Headwater Partners I Llc Wireless network service interfaces
CN102045712B (zh) 2011-01-04 2013-03-20 奇智软件（北京）有限公司 一种用于移动终端的防监听方法及系统
DE102011012226A1 (de) * 2011-02-24 2012-08-30 Giesecke & Devrient Gmbh Verfahren zum Betrieb einer Mikroprozessoreinheit, insbesondere in einem mobilen Endgerät
CN102761409A (zh) 2011-04-29 2012-10-31 德信智能手机技术（北京）有限公司 提高通话安全性的方法和通话设备
CN102209318A (zh) 2011-05-18 2011-10-05 武汉天喻信息产业股份有限公司 一种基于智能tf卡的手机实时加密通话方法及装置
CN102857914A (zh) * 2011-06-28 2013-01-02 芯讯通无线科技（上海）有限公司 Nfc通信安全系统及nfc安全通信的方法和移动终端
CN102307346B (zh) 2011-08-29 2014-01-29 成都华之芯科技有限公司 手机通信保密方法及保密手机
US9430641B1 (en) * 2011-11-03 2016-08-30 Mobile Iron, Inc. Adapting a mobile application to a partitioned environment
CN102413462B (zh) 2011-11-21 2013-12-18 郑州信大捷安信息技术股份有限公司 基于安全tf卡的增强移动终端系统语音通信安全性的方法及系统
KR101925806B1 (ko) * 2011-12-02 2018-12-07 삼성전자 주식회사 보안 방법 및 장치
US20130145475A1 (en) 2011-12-02 2013-06-06 Samsung Electronics Co., Ltd. Method and apparatus for securing touch input
CN103249036B (zh) 2012-02-10 2017-11-17 宇龙计算机通信科技(深圳)有限公司 移动终端的安全通话方法及移动终端
CN103581422A (zh) 2012-08-09 2014-02-12 富泰华工业（深圳）有限公司 通信终端及其防窃听通信方法
US20160014099A1 (en) * 2013-03-07 2016-01-14 Icelero Inc System and method for secure voip communication
US20140281560A1 (en) * 2013-03-15 2014-09-18 Ologn Technologies Ag Secure zone on a virtual machine for digital communications
WO2014141206A1 (fr) * 2013-03-15 2014-09-18 Ologn Technologies Ag Zone sécurisée sur machine virtuelle pour communications numériques
CN103457958A (zh) * 2013-09-18 2013-12-18 浪潮电子信息产业股份有限公司 一种云计算网络服务器内核安全访问方法
US9858444B2 (en) * 2016-02-02 2018-01-02 Dell Products L.P. Securing a human interface device input to wireless display device
US11190495B2 (en) * 2017-10-02 2021-11-30 Colossio, Inc. One-time-pad encryption
US10299304B1 (en) * 2017-11-15 2019-05-21 International Business Machines Corporation Securely communicating a status of a wireless technology device to a non-paired device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120216242A1 (en) * 2011-02-22 2012-08-23 PCTEL Secure LLC Systems and Methods for Enhanced Security in Wireless Communication
CN102271191A (zh) * 2011-08-31 2011-12-07 宇龙计算机通信科技(深圳)有限公司 移动终端和数据访问方法
CN103197991A (zh) * 2012-01-09 2013-07-10 Lg电子株式会社 移动终端及其控制方法
CN103577740A (zh) * 2012-08-02 2014-02-12 中国移动通信集团公司 一种实现安全通信的方法和智能移动终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3282735A4 *

Also Published As

Publication number Publication date
KR20170140344A (ko) 2017-12-20
EP3282735A4 (fr) 2018-04-25
CN106211144B (zh) 2020-06-16
EP3282735A1 (fr) 2018-02-14
CN106211144A (zh) 2016-12-07
US20180054732A1 (en) 2018-02-22
US10638311B2 (en) 2020-04-28
KR101940164B1 (ko) 2019-01-18

Similar Documents

Publication Publication Date Title
US10531289B2 (en) Secure data transmission apparatus and method
US9369441B2 (en) End-to-end secure communication system
US8832783B2 (en) System and method for performing secure communications
US11392708B2 (en) Method and system for embedding security in a mobile communications device
CN109902477B (zh) 保障音频通信安全
US9426159B2 (en) Securing sensor data
JP2015531944A (ja) データトラフィックへの未認証アクセスの軽減
WO2017045417A1 (fr) Procédé et appareil de commande à distance et terminal mobile
CN108616878B (zh) 一种加密解密方法、设备和计算机存储介质
WO2016173284A1 (fr) Procédé de communication de terminal mobile, et terminal mobile
WO2017161724A1 (fr) Procédé et dispositif de traitement vocal, et terminal
TW201334595A (zh) 加密行動通訊之簡訊的方法
WO2023246927A1 (fr) Système de bureau en nuage, procédé de redirection de réseau, et dispositif et support de stockage
US20160219037A1 (en) Secure data entry via audio tones
US20210119980A1 (en) Operating environment partitioning for securing group communication device resources
CN108701195B (zh) 一种数据安全保护方法及装置
JP2007058742A (ja) 在宅オペレータ認証プログラム及び在宅オペレータ認証端末プログラム
CN109561407B (zh) 一种通话处理方法及通话终端
US10348691B2 (en) System and method for controlling, sharing, release and management of digital data between smart mobile device(s) and external device(s) using a connector pad
US20120173879A1 (en) Secure transfer of data using a file transfer application over a usb transport layer
US20240015007A1 (en) Systems and techniques for authentication and security
CN204206218U (zh) 一种移动设备VoIP加密系统
Liu et al. Enforcing End-to-End Security for Remote Conferencing
CN117956471A (zh) 一种无线接入点接入方法、存储介质和服务器
KR20120117497A (ko) 이동식 단말 장치, 이를 이용한 데이터 통신 방법 및 애플리케이션 설치 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890658

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2015890658

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20177034118

Country of ref document: KR

Kind code of ref document: A